Translating classic ACLs to site-to-site VPN firewall rules

[iores]

Hi,

I need to translate hundreds of individual ACLs to one "big ACL" comprised of site-to-site VPN firewall rules.

Since the site-to-site VPN firewall rules are applied to the whole organization, it is not just copy-and-paste.

What are you experiences or suggestions to effectively perform this?

[alemabrahao]

You can use APIs.

https://developer.cisco.com/meraki/api-v1/update-organization-appliance-vpn-vpn-firewall-rules/

[iores]

I was aiming more at how to create one big central ACL from hundreds of single ACLs, without the need to analyze every ACL entry. For example, if one ACL entry at location X, uses summarized prefix (10.0.0.0/8) to denote source IPs at that specific location, if I just copy this as site-to-site VPN firewall rule I could influence traffic from all locations, not just X, and I don't want to do that. 

[alemabrahao]

I believe there's no magic/easy solution.

You have to analyze each ACL you create to know which sources, destinations, and ports to allow or deny.

How can you do this without even knowing the current configuration?

[ww]

Maybe you could use group policies and attach it to a vlan. Group policy fw rules are stateless like acl's.

[PhilipDAth]

It's a horrible job.

What I have done previously is to use the "Rule description" field to tag where the rule was migrated from.  For example:

fwcorp-inside-to-brancha-cameras

You can also search on these, which reduces the huge monolith of rules down to just the narrow set you are interested in.